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Abstract 

This article describes a decision-making system composed of a number of safety and 
environmental models for the launch phase of a NASA Space Shuttle mission. The components 
of this distributed simulation environment represent the different systems that must collaborate to 
establish the Expectation of Casualties (E c ) caused by a failed Space Shuttle launch and 
subsequent explosion (accidental or instructed) of the spacecraft shortly after liftoff This 
decision-making tool employs Space Shuttle reliability models, trajectory models, a blast model, 
weather dissemination systems, population models, amount and type of toxicants, gas dispersion 
models, human response functions to toxicants, and a geographical information system. Since 
one of the important features of this proposed simulation environment is to measure blast, toxic, 
and debris effects, the clear benefits\ is that it can help safety managers not only estimate the 
population at risk, but also to help plan evacuations, make sheltering decisions, establish the 
resources required to provide aid and comfort, and mitigate damages in case of a disaster. 
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Introduction 

Range safety is an important task leading up to and during a space launch. Its goal is to provide 
for the safety of the public on the ground, the astronauts, the workforce, surrounding 
infrastructure, airborne aircraft and seafaring ships in the vicinity of the spaceport. Estimates of 
the population at risk are crucial for safety managers to allow planning for a potential disaster. 
Often this is not a straightforward task to accomplish and the use of decision-support systems 
based on distributed computer simulations may enable safety managers not only to establish 
mitigation projects, but also to better understand the different risks associated with range 
operations. 

This team developed a Virtual Range system to support the process of risk estimation and 
decision making that serves as a prototype of a distributed simulation system. The goal of this 
system is to study the safety criteria for National Aeronautics and Space Administration’s 
(NASA) current and next generation space vehicles throughout range operations. This system 
integrates, in a seamless fashion, several models to improve complex systems visualization in a 
unique collaborative computing environment. It uses: 

• A Shuttle launch trajectory model with estimates of probability of failure of the launch 
through the different stages from liftoff until separation of the solid rocket boosters, 
which occurs approximately 2 minutes after liftoff 

• A blast model 

• A toxics/gas dispersion model 



• A geographic information systems (GIS) 

• A weather information systems 

All these models are hosted and integrated with parametric features of the space vehicles and 
their flight trajectories to compute the Expectation of Casualties (E c ) (see Figure 1). 

Take in Figure 1 

In this paper, the range is defined to be the volume through which the space vehicle must pass on 
its way to and from space, along with its projection onto the earth. Among the different 
operations involved in range support are security, weather, facilities, vehicle processing, and 
safety. One of range safety’s major concerns is the safety of the people within the projection of 
the range volume onto the earth’s surface that may be exposed in the event of a disaster. The 
actual dimensions of the volume and its projection onto the surface depend on the vehicle s 
speed and direction, As the space vehicle moves, the range encompasses new volumes and leaves 
behind areas that fall out of range of potential hazards. This makes range safety, like many other 
operations, have a high level of complexity. Normally, the range safety office is responsible for 
the study, modeling, analysis and assessment of the exposure to potential launch accidents and 
the corresponding calculations of E c . The effects of toxic gases, debris impacts, and blast 
overpressures on the population are the primary hazards to be studied. 

Toxic gas may be caused by an explosion within the solid rocket booster (Figure 2) fuel which is 
found on many of today’s space vehicles. In addition to the toxic release, vehicle explosions 
caused by these system failures produce debris hazards and may also create a blast overpressure. 
The modeling of these effects can take considerable effort. Therefore, the integration of these 
safety models with flight trajectories, available weather information, and GIS systems may 
largely benefit the range safety office. 

A mishap is simulated by using a Monte Carlo simulation which works by generating random 
numbers based on the probability of occurrence of certain events (in our case the events refer to 
those causes which may result in the loss of a vehicle). The probability of each major event was 
determined in previous work (Sepulveda et al. 2004). Hosting the range models and vehicle 
models in a distributed computer simulation system will provide decision support to managerial 
issues concerning risk. 


Take in Figure 2 

The applications of the Virtual Range are very broad; however this article will focus just on 
determining the E c of a population at risk of experiencing exposure to a toxic gas as result of a 
potential disaster within 120 seconds of a Space Shuttle liftoff and will just touch upon the 
effects of blast overpressure. This distributed decision-making system can assist safety managers 
in estimating the population at risk, and as a result, plan for areas to shelter, evacuate, and/or for 
the resources required to provide aid and comfort and mitigate damages. The toxic gas-related 
risk is a factor of exposure duration and toxic propellant concentration or dosage that would 
result in casualties (“Casualty is considered to include either death or injury, of at least 1-day 
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disability, from the direct effects of an accident” (Anderson and McCaleb, 2004)) to normal and 
sensitive people in a given population area. 

The Virtual Range’s Architecture 

The Virtual Range integrates a Geographic Information System (GIS), a population model, gas 
dispersion/blast effects models, Space Shuttle flight trajectory and reliability and failure models, 
and weather data. The architecture is modular so that it can be easily applied to any space vehicle 
models and/or launch operation areas. 

The need for a simulation of these factors is paramount. For example, toxic gas impact risk is 
affected by the variability in the meteorological and launch vehicle parameters, wind 
uncertainties, and other weather related characteristics. Monte Carlo simulation is also used to 
determine the go/no go launch decision. For any planned flight path, safety needs to determine 
the E c using the actual conditions (input parameters). These analyses will identify parameters 
with the largest impact on the value of Ec and, therefore, identify where modeling accuracy is 
most critical. 

If an accident occurs, the Virtual Range system determines the position of the space vehicle, the 
impacted volume, weather data and its trends, and initial dispersion velocity of the released 
pollutants. These values are the input to the Virtual Range dispersion model called CALPUFF 
(Earth Tech, 1997; Earth Tech, 2002) a multi-layer, multi-species, non-steady state Lagrangian 
puff dispersion model - which in turn predicts the toxic concentrations of the toxicant at a 
specified time after the onset of the accident. These values determine the envelope over land 
where the pollutant concentration exceeds the ceilings imposed by the pollutant’s Exposure 
Response Functions (ERFs). We use the number of exposed people under that envelope to 
estimate the number of casualties resulting from exposure to toxic levels of the released toxic 
propellant for that simulated disaster. 

For the E c calculation restricted to gas dispersion, we focused on displaying boundaries. We 
used as a critical value the concentration defined for an E c of 30x10-6 casualties/launch (i.e., 30 
casualties per million flights). This number is widely accepted in the safety community and is 
the result of a number of legal decisions related to carcinogens causing cancer and is generally 
accepted by the United States Federal Aviation Administration (FAA). Anderson and McCaleb 
(2004) state that “this criterion was derived from the principle that the ranges should be operated 
in a manner that is as safe to the public as general or commercial aviation.” However, this 
principle is being changed to one that says the launch must be no more hazardous than day-to- 
day operations. 

Factors Affecting E c 

This section focuses on the factors that may affect the computation of E c . 

Flight Path 

For a planned flight trajectory (altitude, speed, direction), the system projects an appropriate 
“envelope” (i.e., the footprint of the projected impact) for a given risk-component. We focused 
on released toxic gases and used the CALPUFF model to predict their path and concentration 
levels. 
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Figure 3 displays the typical launch sectors for launches from the Eastern Range which includes 
Cape Canaveral Air Force Station, Kennedy Space Center (KSC), owned or leased facilities on 
downrange sites such as Antigua and Ascension; and in the context of launch operations, the 
Atlantic Ocean, including all surrounding land, sea, and air space within the reach of any launch 
vehicle extending eastward into the Indian and Pacific Oceans). 

In general, space vehicles are launched in an easterly direction and on an azimuth that provides 
protection of land masses and populated areas on and off the facility, including the Caribbean 
Islands, Bermuda, the Northeast coasts of South America, and Africa. 

Take in Figure 3 


Space Shuttle Probabilities of Failure 

The second factor is the exact location where the accident occurs. The Virtual Range interface 
grants the safety official the ability to select a random occurrence for the accident or to “fix” the 
time or location of the accident. There is also a third time-related option, which is to specify a 
series of observations at fixed time intervals (for example, at 0, 10, 20, 30, etc. seconds after 
launch). Monte Carlo simulation works by generating random numbers based on the probability 
of certain events occurring which are obtained from a comprehensive reliability model developed 
for NASA (Fragola and Maggio, 1995). This reliability model presents the total probability of 
losing the space vehicle due to the failure of a Space Shuttle system or subsystem. In order to 
obtain the probability of losing the vehicle at the different stages during the first 120 seconds we 
divided that period of time into representative events. We also determined the range of time for 
each of these events. We next calculated the probability of losing the vehicle as a result of an 
issue within one of the main components such as the external tank, space shuttle main engine, 
integrated solid rocket booster, or orbiter (see Figure 2). 

With the intention of getting a better estimate of the probability at different stages, Space Shuttle 
experts were asked to assign weights to represent their best estimate of a failure occurring in a 
given subsystem during a given time or event of Space Shuttle operation. With this information 
the total probability was weighted and calculated at each stage within the first 120 seconds. 

The Toxic Gas 

In addition to the main engines, the Space Shuttle relies upon two Solid Rocket Boosters (SRBs) 
to launch the Space Shuttle into space. The SRBs contain aluminum powder as fuel and 
ammonium perchlorate as its oxidizer. This combination creates 2-Normal hydrochloric acid 
(HC1) as a major combustion bi-product. Due to its relative high quantity, the expected direction 
and ground level concentration of the HC1 gas is a major determinant considered during launch 
decisions. During a nominal launch the total exhaust of HC1 is 163.3 tons during the first 15 
kilometers of flight. About 72.5 more tons are exhausted at higher altitudes in the first two 
minutes after launch (American Institute of Aerospace and Astronautics, 1 992). If a “loss of 
vehicle” event occurs close enough to lift-off, it is possible under certain meteorological 
conditions that the ground concentration would exceed 7 ppm, which is the short-term exposure 
limit (STEL) for HC1 for normal people (Hill Brothers Chemical Company, 2001). 
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Exposure to the HCL gas for normally healthy persons can vary by location and the reaction to 
the exposure can vary from mild to severe by individual. Mild HC1 exposure symptoms include 
irritation and headache, which are reversible within 48 hours and do not interfere with normal 
activity or require medical attention (Philipson, 1999). Moderate symptoms include cough and 
shortness of breath, and medical attention might be necessary. Severe symptoms include 
disorientation due to constriction of the airway and consequent shortfall in delivery of oxygen to 
the brain; changes to lung tissue are irreversible in this category. Of course, the STEL values for 
sensitive people (children, the elderly, and people with asthma or other respiratory diseases) are 
even smaller and very difficult to predict. 

The Gas Dispersion Model. 

For the evaluation of the gas dispersion and toxic effect we use CALPUFF, a model developed 
and distributed by Earth Tech (2002). CALPUFF simulates the effects of time and space by 
varying meteorological conditions on pollutant transport, transformation, and removal under 
inhomogeneous and non-stationary conditions. CALPUFF modules allow one to assess toxic 
effects of specific chemical agents and factors such as variability of meteorological conditions, 
dry deposition and dispersion over a variety of spatially varying land surfaces, low wind speed 
dispersion, or wet removal of the pollutant. 

There are several factors associated with CALPUFF that may affect the value of E c , the most 
important of which are the initial speed of the toxic plume as it is exhausted, the weather 
conditions (humidity, temperature, pressure, etc.), the wind speed and direction. 

The Weather Factor. CALPUFF is accepted by the US Environmental Protection Agency (EPA) 
as a guideline model used in all regulatory applications involving the long-range (>50km) 
transport of pollutants. It can also be used on a case-by-case basis in situations involving 
complex flow and non-steady-state cases from fence-line (near field) impacts out to 50 km. The 
model consists of three main components (models): CALMET, CALPUFF, and CALPOST. In 
addition, it also includes several pre-processing programs to interface the model with standard, 
routinely-available, meteorological, and geophysical datasets. 

CALMET is a meteorological model that develops hourly wind and temperature fields on a 
three-dimensional grid modeling domain with associated two-dimensional fields such as mixing 
height, surface characteristics, and dispersion properties. Selected temporal and spatial variations 
in the meteorological fields are explicitly incorporated in the resulting distribution of puffs 
throughout a simulation period. 

CALPUFF contains algorithms for near-source effects such as building downwash, transitional 
plume rise, partial plume penetration, and sub-grid scale terrain interactions, as well as longer 
range effects such as pollutant removal (wet scavenging and dry deposition), chemical 
transformation, vertical wind shear, over-water transport, and coastal interaction effects. It can 
accommodate arbitrarily- varying point source and grid area source emissions. Most of the 
algorithms contain options to treat the physical processes at different levels of detail depending 
on the model application. The primary output files from CALPUFF contain either hourly 
concentrations or hourly deposition fluxes evaluated at selected receptor locations. 
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CALPOST is used to process the output files produced by CALPUFF. In addition, CALPOST 
summarizes the results of the simulation. 

Meteorological Surface Data. The meteorological surface observations are obtained from the 
National Oceanic and Atmospheric Administration (NOAA) 2004. These meteorological data 
files contain near real-time observations of: wind speed, wind direction, temperature (part of 
surface data file), cloud cover, ceiling height, surface pressure, relative humidity, and 
precipitation type code. 

To improve the accuracy, given the position and code of the station, the meteorological surface 
data acquires information from nearby weather stations. We used the data from four different 
stations near Kennedy Space Center. 

Upper Air Data. This set of observations contain observed vertical profiles of: wind speed, wind 
direction, temperature, humidity, pressure, and elevation. The data is obtained from NOAA’s 
Radiosonde Database Access. 

Geophysical Data. This data file contains the geophysical data inputs required by the CALMET 
model. These inputs include: grid fields of terrain elevations, land use categories, surface 
roughness length, albedo, Bowen ratio, soil heat flux constant, anthropogenic heat flux, and 
vegetative leaf area index. 

Over-water Data. This data is necessary to know the Over-water transport and dispersion. It is 
necessary to have the following information: air-sea temperature difference, air temperature, 
relative humidity, over-water mixing high, and wind speed and direction. The location of the 
over-water site is specified for each observation. The information is taken from the closest buoy, 
in this case Station 41009 - CANAVERAL which is located 20 nautical miles East of Cape 
Canaveral. This information is obtained from the National Data Buoy Center, a division of the 
National Oceanic and Atmospheric Administration (National Data Buoy Center Unedited 
Surface Weather Observations, 2004). 


Geographic and Population Models 

The Virtual Range uses ArcGIS, a commercial GIS application from ESRI Corporation that 
provides data visualization, query, analysis, and integration capabilities along with the ability to 
create and edit geographic data (ESRI, 2004) to identify the region threatened by the dispersed 
gas. The area covered in our simulation is basically the area around the Cape Canaveral which 
includes Brevard and Orange Counties, Florida (USA) and a large part of the sea around Cape 
Canaveral. The simulation covers about 150 kilometers in each direction from the source (Cape 
Canaveral). Since this area around Cape Canaveral is a flat, noncomplex terrain and surrounded 
by sea, the weather data plugged into the model plays an important role in the simulation. It has a 
good flow of winds along with the pressure and temperature variations across it. The area 
covered by the simulation is divided into a number of grids with equal spacing to facilitate the 
study of concentrations resulting from a normal launch or from explosions in the area 
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considered. Each grid can be a square block, whose side can range from tens of meters to 
hundreds of kilometers. 

The Virtual Range determines the population at risk for a specific risk-component using the 
LandScan Global Population Database, a public domain database of the world’s population 
developed by the Oak Ridge National Laboratory (ORNL), to present population data associated 
within the covered region (Oak Ridge National Laboratory, 2004). LandScan includes the best 
available census counts, usually at province level, for each country and allocates these figures 
into rural and urban population distributions on a 30" X 30" lat/long grid cell system. To assign 
values to a specific grid cell, LandScan calculates a probability coefficient for each cell and 
applies the coefficients to the census counts. The probability coefficient is based on slope, 
proximity to roads, land cover, night-time lights, and an urban density factor. 

The concentration of toxicant within the area under influence is generated as input to ArcView 
by pre-processing of the Virtual Range model, Monte Carlo model and Calpuff/Calmet/Calpost. 
The necessary steps to generate the E c number and a display of the area of impact are the 
following: 

1 . The LandScan population data, in raster format, is imported in the Universal Transverse 
Mercator (UTM) coordinates. 

2. The input text file which includes the area under influence in UTM Coordinates and the 
ground level concentration of HC1 for a particular area of interest are imported on top of 
the population map as a data layer. Later the two layers are combined to select only the 
cross areas. 

3. The added point of the HC1 layer is saved into a feature dataset for query. 

4. Then, the query is run on the saved HC1 layer to select the region where the concentration 
of the HC1 is 7 ppm, i.e., 0.0104387 gm/m 3 . 

After performing the above steps, the Zonal Statistics function of Spatial Analyst is used to 
calculate the total number of people affected by 7 ppm of HC1. 

Zonal Statistics calculates the statistics for each zone of a zone-dataset based on values from 
another dataset. A zone is a region in which all the cells in a raster have the same value, 
regardless of whether or not they are contiguous. The output sum in the zonal statistics gives the 
total number of people affected in that 7ppm of HC1 zone. 

Exposure Response Functions 

Figure 4 shows the Exposure Response Functions (ERFs) for HC1 for sensitive and normal 
people subject to a 30-minute exposure. The sensitive population was defined as children 
through age 14 and adults aged 75 and over, as well as all others with respiratory illnesses. In 
Brevard County, recent census data shows that 42% of the population is composed of those 
either 18 and younger or 65 and older; this number is expected to increase to about 55% by the 
year 2010 (United Way of Brevard County, 2002). These curves show that concentrations of 1 5 
ppm and 41.5 ppm of HC1 result in an expectation of casualties of about 30 in a million launches 
(Ec^ 30x1 O’ 6 ) for sensitive and normal people, respectively. 
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Take in Figure 4 


ERF curves have been computed for nitric acid, nitrogen dioxide, and hydrochloric acid 
(Philipson, 1999). They were constructed by a panel of about 20 expert toxicologists who 
provided best estimates of the 1 and 99-percentiles of expected casualties. Below the first 
percentile, “essentially no one in a population of a given sensitivity category would be affected 
to a given level of severity.” Above the 99th percentile, “essentially everyone in the population 
would be so affected.” Twelve estimates, with ranges of uncertainty, for each substance, and 
duration of exposure (10, 30, 60, and 120 minutes) were provided by members of the panel of 
experts: one for each percentile, casualty type (mild, moderate, and severe), and victim type 
(sensitive, normal). Some of the panelists computed duration estimates from 1-hour estimates 
according to Haber’s Law, which states that “an effect level is directly proportional to exposure 
concentration multiplied by time” (Philipson, 1999). Once these estimates were decided upon by 
the panel, ERF curves were then calculated as cumulative distributions. 

Geographic Data Model 

ArcGIS is used along with the LandScan Global Population Database. In this GIS environment, 
a model of population distribution is integrated with the gas dispersion model to calculate E c for 
that risk component, given there is a loss of the space vehicle. Spatial Analyst, an extension 
toolset in ArcGIS, is used to generate the query on the HC1 data from the Gas Dispersion Model 
to select the region where the concentration of the HC1 exceeds a critical value (see Figure 5). 

Take in Figure 5 

Note that Spatial Analyst and LandScan combine to give an estimate of the number of people 
that may be exposed in the affected area. However, this figure represents an upper limit for the 
number of people at risk as some people will undoubtedly be able to take cover or flee the region 
before the gas dispersion reaches it. Still a sensitivity analysis could be done on the proportion of 
the exposed people that will actually die or be incapacitated as a result of the accident. 

Blast Effects 

Among all the prospective hazards resulting from an explosion, those caused by blast 
overpressure waves are often the most destructive. Thus, in addition to the previous gas 
dispersion models described, a validation was performed on a hybrid approach to predict blast 
hazards by simulating explosions of the Space Shuttle after liftoff from launch pad LC-39A at 
KSC. The hybrid approach was necessary to overcome the limited capability of Blast/FX, the 
blast modeling software at hand. Blast/FX was developed by Northrop Grumman Mission 
Systems to determine the effects of explosives against facilities and the people in those facilities. 
It is based on the TNT equivalency method of blast overpressure prediction (See Figure 6). 

Take in Figure 6 


Summary and Conclusions 
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The Virtual Range system works as follows: A discrete-event simulator simulates the time of the 
accident, which is determined by the cumulative probability of an accident occurring in different 
stages of a launch. Each of these stages has a different duration and chance of accident. Based 
upon the time of the accident, the model references coordinates for the path of the space vehicle 
and determines the volume of remaining pollutants from the existing model data file. 

These values are the input to CALPUFF, which in turn predicts the toxic concentrations for each 
toxicant at hourly intervals. These values are entered automatically as a layer into ArcGIS, to 
determine the envelope over land where the pollutant concentration exceeds the ceilings imposed 
by the corresponding ERF. 

ArcGIS’s Spatial Analyst has the ability to determine the number of people covered by the . \ 
displayed layer. We use the number of exposed people and the parameters resulting from the 
pollutant’s ERF to estimate the number of casualties for a simulated disaster resulting in 
exposure to toxic levels of the released toxicant. Repeating the procedure through enough 
simulation runs, we can get enough information to generate an “average” boundary and its 
associated confidence interval. 

The modular architecture of the Virtual Range allows for the analysis of new vehicles (e.g., the 
Crew Exploration Vehicle being designed by NASA for the exploration of the Moon and Mars 
(National Aeronautics and Space Administration, 2004)) and the study of other launching sites. 

In addition, we are in the process of integrating debris and blast models. As a result, safety 
managers could know more about the number of casualties (fatalities, serious and slight injuries, 
and uninjured) and the level of damage to buildings and facilities for different scenarios. 
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Figure 1 . The Virtual Range and its modules (fragmentation and blast capabilities are currently being added). 



Figure 2. The NASA Space Shuttle in its launch configuration (Adapted with modifications from 
http://spaceflight.nasa.gov/shuttle/reference/basics/images). 
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Figure 3. Launch flight corridor, adapted from the Federal Aviation Administration AST Office, 2002. The launch 
vehicle must stay within the hatched area or the flight will be terminated. . 
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Figure 4. Exposure Response Function for HC1. 
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Figure 5. Exercising the Virtual Range system: Output of CALPUFF in ArcGIS from a simulated accident at 34 
seconds with specific weather information on October 7, 2002 (2:46 p.m. Central Daylight Time) (Launch Date and 
Time of NASA Shuttle Atlantis, STS-1 12 (Space Transportation System - Mission 112)). 
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Figure 6. Depiction of experiments of the blast effects for a NASA Shuttle after liftoff (background adapted from 
http://mediaarchive.ksc.nasa.gov/search.cfm). 


15 


